cancel
Showing results for 
Search instead for 
Did you mean: 
Post a Question

R80.20 Identity Awareness API

Hi,

I'm trying to implement IA API & clearpass however API URL is not responding and pdp API status returns Invalid colmand

Do we need to enable something on the gateway on top of SmartConsole config (IA source)?

Thank you

Tags (3)
0 Kudos
5 Replies

Re: R80.20 Identity Awareness API

Hi Nicolas,

Did you enable Identity Web API and allowed the specific hosts under Gateway's IA configuration??

Regards.

0 Kudos

Re: R80.20 Identity Awareness API

Yes it's enabled in SmartConsole

0 Kudos
Admin
Admin

Re: R80.20 Identity Awareness API

Did you set the allowed interfaces?

For my first try, I forgot to do that.

Here's what I saw when I queried the API endpoint directly using curl from a Linux machine:

curl --silent --insecure -XPOST https://<gw-ip>/_IA_API/idasdk/show-identity -H "Content-Type: application/json" --data-binary "{}"

<!DOCTYPE html><HTML><HEAD>

<meta http-equiv="Content-Type" content="text/html; charset=utf-8"><meta http-equiv="X-UA-Compatible" content="IE=EmulateIE9,EmulateIE8"><meta name="others" content="WEBUI LOGIN PAGE"  /><TITLE>Gaia</TITLE>

<link rel="shortcut icon" href="https://community.checkpoint.com/login/fav.ico">

<link rel="stylesheet" type="text/css" href="https://community.checkpoint.com/login/ext-all.css" />

<link rel="stylesheet" type="text/css" href="https://community.checkpoint.com/login/login.css" />

<STYLE TYPE="text/css">

.ext-ie .webui-login-fld{font-size: 11px;}

</STYLE>

<script type="text/javascript" src="/login/ext-base.js"></script><script type="text/javascript" src="/login/ext-all.js"></script><script type="text/javascript">var errMsgText = "";var bannerMsgText = "";bannerMsgText += "This system is for authorized use only.";var hostname='';var version='R80.20';var formAction="/cgi-bin/home.tcl";</script><script type="text/javascript" src="/login/login.js"></script></HEAD><BODY><noscript><div style='font-size:20px;position:relative;top:100px;'>For full functionality of this site it is necessary to enable JavaScript.</div></noscript></BODY></HTML>

This tells me MultiPortal believes the connection should go to the Gaia portal, which is the default.

After setting the allowed interfaces for the IDA API as shown above, I got a different message when querying the API:

curl --silent --insecure -XPOST https://<gw-ip>/_IA_API/idasdk/show-identity -H "Content-Type: application/json" --data-binary "{}"

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">

<HTML>

<HEAD>

<TITLE> 404 File Not Found </TITLE>

</HEAD>

<BODY>

The URL you requested could not be found on this server.

</BODY>

</HTML>

When I actually pass the correct information via the API call, I get a meaningful result:

curl --silent --insecure -XPOST https://10.6.5.1/_IA_API/idasdk/show-identity -H "Content-Type: application/json" --data-binary "{ \"shared-secret\": \"aaaa\", \"ip-address\": \"1.1.1.1\" }"

{

   "ipv4-address" : "1.1.1.1",

   "message" : "total 0 user records were found."

}

0 Kudos

Re: R80.20 Identity Awareness API

Hi Dameon,

Yes of course we did but we don't get any answer from API... We also tried to change setting On all interface to make sure but without success

I will try to reboot the gateway this weekend or open a TAC ticket

Thank you

0 Kudos
Admin
Admin

Re: R80.20 Identity Awareness API

No answer at all?

Maybe the firewall access policy is blocking the traffic.

Any logs?

What does tcpdump/fw monitor show?

0 Kudos